STIGQter STIGQter: STIG Summary: Enterprise Voice, Video, and Messaging Policy Security Requirements Guide Version: 1 Release: 4 Benchmark Date: 05 Jan 2026:

When soft-phones are implemented as the primary voice endpoint in the user's workspace, a policy must be defined to supplement with physical hardware-based phones near all such workspaces.

DISA Rule

SV-259906r1173932_rule

Vulnerability Number

V-259906

Group Title

SRG-VOIP-000260

Rule Version

SRG-VOIP-000260

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

If PC soft-phones and/or UC applications are implemented as the primary telephone endpoint in the user's workspace, ensure hardware-based telephone instruments are installed within a short distance (e.g., 30 to 50 feet) of every workspace to be used for backup and emergency communications.

NOTE: This requirement is satisfied by the implementation of hard-wired hardware-based telephone instruments using any telephony technology. That is, traditional analog or digital instruments may be used, or VoIP-based instruments may be used. Such instruments may be part of the local site's PBX or VoIP system or may be served from the Local Exchange Carrier (LEC) or Competitive LEC (CLEC). Power is another concern when implementing backup/continuity of operations (COOP) or emergency telephones. Such phones should be remotely powered from a source that can provide backup power. Additionally, the dialing capabilities of backup/COOP or emergency telephones may be limited to internal and/or emergency calls. This means that minimally, emergency service numbers must be reachable from these phones.

Check Contents

Part 1:
Determine if PC soft-phones and/or UC applications are implemented as the primary telephone endpoint in users' workspaces. If so, inspect users' work areas to determine if hardware-based telephone instruments are installed within a short distance (e.g., 30 to 50 feet) of every workspace to be used for backup and emergency communications. Cellphones, PDA/PEDs, or other wireless devices are not considered reliable enough to meet this requirement due to lack of reliable signal available everywhere and their inability to be used in certain DOD environments.

If these conditions are not met, this is a finding.

NOTE: This requirement is satisfied by the implementation of hard-wired hardware-based telephone instruments using any telephony technology. That is, traditional analog or digital instruments may be used, or VoIP-based instruments may be used. Such instruments may be part of the local site's PBX or VoIP system or may be served from the Local Exchange Carrier (LEC) or Competitive LEC (CLEC). Power is another concern when implementing backup/continuity of operations (COOP) or emergency telephones. Such phones should be remotely powered from a source that can provide backup power. Additionally, the dialing capabilities of backup/COOP or emergency telephones may be limited to internal and/or emergency calls. This means that minimally, emergency service numbers must be reachable from these phones.

Part 2:
Select a random sample if not all of the implemented hard-phones and test them to ensure they are functional.

If nonfunctional phones are found, this is a finding.

Vulnerability Number

V-259906

Documentable

False

Rule Version

SRG-VOIP-000260

Severity Override Guidance

Part 1:
Determine if PC soft-phones and/or UC applications are implemented as the primary telephone endpoint in users' workspaces. If so, inspect users' work areas to determine if hardware-based telephone instruments are installed within a short distance (e.g., 30 to 50 feet) of every workspace to be used for backup and emergency communications. Cellphones, PDA/PEDs, or other wireless devices are not considered reliable enough to meet this requirement due to lack of reliable signal available everywhere and their inability to be used in certain DOD environments.

If these conditions are not met, this is a finding.

NOTE: This requirement is satisfied by the implementation of hard-wired hardware-based telephone instruments using any telephony technology. That is, traditional analog or digital instruments may be used, or VoIP-based instruments may be used. Such instruments may be part of the local site's PBX or VoIP system or may be served from the Local Exchange Carrier (LEC) or Competitive LEC (CLEC). Power is another concern when implementing backup/continuity of operations (COOP) or emergency telephones. Such phones should be remotely powered from a source that can provide backup power. Additionally, the dialing capabilities of backup/COOP or emergency telephones may be limited to internal and/or emergency calls. This means that minimally, emergency service numbers must be reachable from these phones.

Part 2:
Select a random sample if not all of the implemented hard-phones and test them to ensure they are functional.

If nonfunctional phones are found, this is a finding.

Check Content Reference

M

Target Key

5585